CWE Lookup Tool

Search the CWE database for software security weaknesses. Find vulnerability types, descriptions, and remediation guidance.

Advertisement

What Is CWE (Common Weakness Enumeration)

CWE (Common Weakness Enumeration) is a community-developed catalog of software and hardware security weakness types maintained by MITRE Corporation. Each CWE entry describes a specific class of vulnerability—such as buffer overflow, SQL injection, or improper authentication—with a unique identifier (e.g., CWE-79 for Cross-Site Scripting), technical description, examples, mitigations, and relationships to other weaknesses.

While CVE (Common Vulnerabilities and Exposures) identifies specific vulnerabilities in specific products, CWE classifies the underlying weakness patterns that cause vulnerabilities. A single CWE can be the root cause of thousands of CVEs. Understanding CWEs helps developers write more secure code, security teams prioritize remediation efforts, and organizations build systematic defenses against entire categories of vulnerabilities.

How CWE Is Organized

CWE uses a hierarchical structure with multiple abstraction levels:

LevelDescriptionExample
PillarHighest abstraction (broad categories)CWE-664: Improper Control of a Resource
ClassA general weakness categoryCWE-20: Improper Input Validation
BaseA specific weakness typeCWE-89: SQL Injection
VariantA detailed sub-typeCWE-564: SQL Injection: Hibernate

MITRE CWE Top 25 Most Dangerous Software Weaknesses (2024 selection):

RankCWENameImpact
1CWE-79Cross-Site Scripting (XSS)Code execution in browsers
2CWE-787Out-of-Bounds WriteMemory corruption, code execution
3CWE-89SQL InjectionData breach, data manipulation
4CWE-352Cross-Site Request ForgeryUnauthorized actions
5CWE-22Path TraversalUnauthorized file access
6CWE-125Out-of-Bounds ReadInformation disclosure
7CWE-78OS Command InjectionSystem compromise
8CWE-416Use After FreeMemory corruption
9CWE-862Missing AuthorizationUnauthorized access
10CWE-434Unrestricted File UploadCode execution

Common Use Cases

  • Secure development: Reference CWE entries during code review to identify and prevent common weakness patterns
  • Vulnerability classification: Map CVEs to their underlying CWEs to understand root causes and prioritize systemic fixes
  • Security training: Use CWE descriptions and examples to educate developers about specific vulnerability categories
  • Tool evaluation: Assess SAST/DAST tools by which CWEs they can detect (CWE coverage)
  • Compliance: CWE is referenced by PCI-DSS, NIST SSDF, and OWASP standards for vulnerability classification

Best Practices

  1. Focus on the CWE Top 25 — These weaknesses cause the most real-world vulnerabilities; prioritize defenses against them
  2. Map your vulnerabilities to CWEs — Understanding root cause categories reveals systemic issues that point fixes miss
  3. Use CWE to guide SAST tool selection — Evaluate static analysis tools by their CWE detection coverage for your technology stack
  4. Integrate CWE into developer training — Train developers on the specific CWEs most relevant to your application's technology stack
  5. Track CWE trends over time — If your team consistently introduces CWE-79 (XSS) bugs, invest in framework-level protections and targeted training
Advertisement
This tool is provided for informational and educational purposes only. All processing happens in your browser — no data is sent to or stored on our servers. While we strive for accuracy, we make no warranties about the completeness or reliability of results.